> objc_msgSend [...] does require malloc,

Are you sure about that?

    ]pwd
    objc4/runtime/Messengers.subproj
    ]rg malloc
    ]

The two variants I implemented way back when also did not require malloc.

And of course NeXT used objc_msgSend() in the kernel, to good effect, so that's pretty low-level.